Expiry - and back to old
Expiry - and back to old
Posted Aug 7, 2026 18:52 UTC (Fri) by marekm (subscriber, #174682)In reply to: Expiry - and back to old by MortenSickel
Parent article: Changes in shadow-utils password-expiration features
Hello, former maintainer here from long long ago (1995-2000).
Oldest version of which I still have a copy is shadow-3.3.1 from around August 1993. Back then I first had access to something new called the Internet (as a student of Wrocław University of Technology) and started using Linux (first Slackware installed from floppies, later Debian from release 0.93r6 until today).
Back then the shadow suite was under an old non-commercial license, there was some controversy about this, later the original author (J.F.Haugh) and other contributors agreed to change to the BSD license (first with the infamous advertising clause, later removed), and I offered to take over maintaining it.
Password expiration features were already implemented and haven't changed much since then. SunOS 4.x didn't have them with only the old /etc/passwd (the shadow suite replaced a few system utilities to add shadow support), proper /etc/shadow support was only added in the new SunOS 5.x aka Solaris 2.x. It also existed in SCO UNIX for backwards compatibility, in addition to a much more complex password database.
Some people were unhappy that existing software had to be modified to support shadow passwords (and some had to be made setuid root to read the password hashes from /etc/shadow), and later the PAM (Pluggable Authentication Modules) project has been created. (I'm not sure in hindsight if all the added complexity of PAM was really worth it - the setuid issue was mostly with X11 screen lock programs, which could simply have read the password hash of the invoking user right at startup and then drop privileges early, and do any possibly insecure graphical stuff only as the ordinary user.)
Oldest version of which I still have a copy is shadow-3.3.1 from around August 1993. Back then I first had access to something new called the Internet (as a student of Wrocław University of Technology) and started using Linux (first Slackware installed from floppies, later Debian from release 0.93r6 until today).
Back then the shadow suite was under an old non-commercial license, there was some controversy about this, later the original author (J.F.Haugh) and other contributors agreed to change to the BSD license (first with the infamous advertising clause, later removed), and I offered to take over maintaining it.
Password expiration features were already implemented and haven't changed much since then. SunOS 4.x didn't have them with only the old /etc/passwd (the shadow suite replaced a few system utilities to add shadow support), proper /etc/shadow support was only added in the new SunOS 5.x aka Solaris 2.x. It also existed in SCO UNIX for backwards compatibility, in addition to a much more complex password database.
Some people were unhappy that existing software had to be modified to support shadow passwords (and some had to be made setuid root to read the password hashes from /etc/shadow), and later the PAM (Pluggable Authentication Modules) project has been created. (I'm not sure in hindsight if all the added complexity of PAM was really worth it - the setuid issue was mostly with X11 screen lock programs, which could simply have read the password hash of the invoking user right at startup and then drop privileges early, and do any possibly insecure graphical stuff only as the ordinary user.)